Sagan high stable other

[WINDOWS-AUTH] DC - Integrity check on decrypted

[WINDOWS-AUTH] DC - Integrity check on decrypted

View Source

Detection Logic

alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[WINDOWS-AUTH] DC - Integrity check on decrypted"; json_map:"event_id",".EventID"; json_map:"message",".RenderedDescription"; event_id: 4768,4771,681,676,675; content: "Failure Code
| 3a
| 0x1F"; classtype: exploit-attempt; program: *Security*; sid:5008460; metadata: created_on 2022_11_22, old_sid 5001195; rev:10;)

Field Validations

Loading…

Comments (0)

Loading comments...